usher/deploy/compose.example.yml at master · mrcsin/usher · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
services:
  awg:
    image: ghcr.io/mrcsin/awg-grpc:v0.1.0
    restart: unless-stopped
    # Docker's init is PID 1 and reaps orphans of awg-quick and PostUp commands.
    init: true
    cap_add: [NET_ADMIN]
    # Lets the interfaces route client traffic; the tunnels carry IPv4 only.
    sysctls:
      net.ipv4.ip_forward: "1"
    # awg gets one pipe per preshared key; 1000 peers come close to the default soft limit of 1024.
    ulimits:
      nofile: { soft: 65536, hard: 65536 }
    # The host port equals the interface port: client configs carry it.
    ports:
      - "51820:51820/udp"
    volumes:
      # One <interface>.conf per interface, [Interface] only.
      - ./awg:/etc/amnezia/amneziawg:ro
      - awg-sock:/run/awg-grpc
    environment:
      # Must equal usher's group.
      AWG_GRPC_SOCKET_GID: "1000"
  xray:
    # Match the xray-core version in usher's go.mod, or usher may report every inbound as drifted.
    image: ghcr.io/xtls/xray-core:26.10.10
    restart: unless-stopped
    # Must equal usher's group, so that usher can open the API socket.
    user: "0:1000"
    command: ["run", "-config", "/etc/xray/config.json"]
    # The host port equals the interface port: client configs carry it.
    ports:
      - "443:443/tcp"
      - "8443:8443/udp"
    volumes:
      # The directory, not the file: usher and Xray then both see a replaced config.
      - ./xray:/etc/xray:ro
      # The certificates and keys that the config names. Only Xray mounts them: usher needs no
      # access to a key file, and Xray reloads the files itself.
      - ./xray-certs:/etc/xray-certs:ro
      # Owned by uid 1000, not a named volume: usher unlinks a stale API socket after a crash.
      - ./xray-sock:/run/xray
  usher:
    image: ghcr.io/mrcsin/usher:v0.2.0
    restart: unless-stopped
    cap_drop: [ALL]
    read_only: true
    security_opt: [no-new-privileges:true]
    depends_on:
      awg:
        condition: service_healthy
      xray:
        condition: service_started
    volumes:
      # The host directories belong to uid 1000.
      - ./usher/config:/srv/usher/config:ro
      - ./usher/clients:/srv/usher/clients
      - usher-state:/srv/usher/state
      - awg-sock:/run/awg-grpc
      - ./xray:/etc/xray:ro
      - ./xray-sock:/run/xray
    environment:
      USHER_HOST: "203.0.113.10"
      USHER_AWG_SOCKET: /run/awg-grpc/awg.sock
      USHER_DNS: "1.1.1.1,1.0.0.1"
      USHER_XRAY_SOCKET: /run/xray/api.sock
      USHER_XRAY_CONFIG: /etc/xray/config.json
volumes:
  awg-sock:
  usher-state: